[Mimedefang] Messages spooled by secondary MX miss Mimedefang?

[cam]

> Can't. My first instinct was to delete the spams. Only later became curious
> enough to query about the problem - expected to learn it was some setting I
> hadn't attended to. Did look at the headers closely first though. The spams
> all went to a secondary spool elsewhere (during a time when my SDSL line was
> tied up in a _large_ rsync operation - yeah, should have rate-limited that)
> and then came from there to the server here, somehow bypassing scanning on
> the way in - at least nothing in the headers at all (no "X-Scanned By"
> even), and they were very obvious spams.
> 
> If I see it again I'll post headers. But the only clue the first time around
> was what wasn't there.
> 
> Thanks for also being curious about this.
> 
> Whit


forgive me if someone has suggested this already (still have about 120 
messages to go to catch up to current for the list :) ).

but depending on how your dns/mx config is setup, that may be your 
problem.

ie... 

my setup *used* to be 2 MX hosts (different weights) in addition to the 
box that ultimately ends up getting the message.  when i installed MD/SA i 
changed all my domains so that there is a single MX, the MD/SA/virus 
scanning system.  (yeah, not the greatest idea, but money is tight atm.)



my guess is that the secondary spooling host is forwarding directly to the 
end system (which it should, technically) instead of what you want it to 
do, forward it to the scanner.  

this can be fixed one of several ways:

* setup the secondary MX with MD/SA
* setup the secondary MX's domaintable (assuming sendmail) to forward to 
the MD/SA box no matter what
* move to the MD/SA box being single MX for the domain(s)


those are the simple solutions off the top of my head, and i'm sure there 
are others (possibly even better) given a little to think on it.

cam proctor
bcp1 at craqskeep.com
bcp1 at kopower.com